From 65c3c19ea583228438217db661006fc705a53fcc Mon Sep 17 00:00:00 2001 From: @permadeath.com Date: Sun, 09 Aug 2026 19:40:29 +0000 Subject: [PATCH] fix(deploy): verify the AWS session with STS before building AWS_PROFILE being set says nothing about the session behind it. Ask STS up front so an expired login fails before the builds, not at the push. Co-Authored-By: Claude Fable 5 --- scripts/deploy.sh | 8 ++++++++ 1 file(s) changed, 8 insertion(s)(+), 0 deletion(s)(-) diff --git a/scripts/deploy.sh b/scripts/deploy.sh --- a/scripts/deploy.sh +++ b/scripts/deploy.sh @@ -20,6 +20,14 @@ : "${AWS_PROFILE:?set AWS_PROFILE; default credentials are almost never the right account}" +# The variable being set says nothing about the session behind it. Ask STS +# now, so an expired login fails here instead of after both builds, when the +# api push is the first thing to touch AWS. +if ! aws sts get-caller-identity --query Account --output text >/dev/null; then + echo "deploy: no working AWS session for profile $AWS_PROFILE; log in again" >&2 + exit 1 +fi + command -v jq >/dev/null || { echo "deploy: jq is not installed; it writes releases.auto.tfvars.json" >&2 exit 1 -- tangled.sh